{"slug": "project-zero-cuts-bug-disclosure-to-90-days-falling-to-30-by-2028", "title": "Project Zero cuts bug disclosure to 90 days, falling to 30 by 2028", "summary": "Google's Project Zero is replacing its 90+30 vulnerability disclosure policy with a single fixed 90-day clock, with no extra soak time after a fix ships, and will cut that window to 30 days by 2028. Project Zero cited large language models shrinking patch-to-exploit time as the reason vendors now get one deadline instead of up to 30 additional days to let users patch.", "body_md": "Under the old 90+30 policy, details waited up to 30 extra days after a fix shipped so users could patch. That soak time is gone, and Project Zero cites LLMs shrinking patch-to-exploit time, so vendors now get one fixed clock that drops to 30 days.\nRead: Under the old 90+30 policy, details waited up to 30 extra days after a fix shipped so users could patch. That soak time is gone, and Project Zero cites LLMs shrinking patch-to-exploit time, so vendors now get one fixed clock that drops to 30 days.\nRead: The data sat in Supabase databases that answered requests with no login, the gap row-level security exists to close. Lovable frames app security as a shared responsibility, so locking down those tables falls to the builder, not the platform that generated them.\nRead: The two newest Claude models now tie after harder tasks cut scores about 5 points on average. Cost per task among top setups runs from $1.51 to $44.22, about 30x, and higher effort can score lower because each task has a time limit.\nTry: With Opus 5.5 or GPT-6.1 Sol held fixed, the harnesses solved similar shares of public dev tasks, so the harness set the cost per solved task. Rules shown every turn were followed far more often than skills the prompt never mentioned.\nWatch: The Grok Bot team encodes its architecture as enforceable lint rules and spends tokens on runtime and formal verification in TLA+ and Lean. At that volume, a 0.5% revert rate still means about 55 reverted PRs a month.\nTry: Each run now returns a judgement with success, failure reason, prompt-injection and captcha flags, and site gotchas, scored by a model the user picks. Agent builders who wrote their own grader get one in the library, though it was measured on only 13 runs.\nRead: Artificial Analysis scored speech-to-text APIs on word-level speaker errors across 97 conversations. The open-weight model's 3.3% is under half of second-place Voxtral Small Transcribe 3 at 7.5%, so a self-hostable model leads paid APIs.", "url": "https://wpnews.pro/news/project-zero-cuts-bug-disclosure-to-90-days-falling-to-30-by-2028", "canonical_source": "https://www.vibeleaderboard.ai/intel/brief/2026-11-15", "published_at": "2026-11-15 12:08:22+00:00", "updated_at": "2026-11-15 12:49:26.241852+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy", "artificial-intelligence"], "entities": ["Google", "Project Zero"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/project-zero-cuts-bug-disclosure-to-90-days-falling-to-30-by-2028", "markdown": "https://wpnews.pro/news/project-zero-cuts-bug-disclosure-to-90-days-falling-to-30-by-2028.md", "text": "https://wpnews.pro/news/project-zero-cuts-bug-disclosure-to-90-days-falling-to-30-by-2028.txt", "jsonld": "https://wpnews.pro/news/project-zero-cuts-bug-disclosure-to-90-days-falling-to-30-by-2028.jsonld"}}